AIKIDO-2026-965601

TL;DR

Claude Code fetches an organization's server managed settings with a locally stored API key, for example one left from an earlier /login or written to its configuration, instead of the user's valid Claude Enterprise or Team sign-in. When the settings endpoint rejects that stored key, the session starts without the organization's managed policy, such as permission deny rules, model restrictions, and managed only locks, or keeps using a stale cached copy, while still running under the organization's account. The fix gives the Enterprise or Team sign-in credential precedence for the managed settings request.